IdP v3 Relying Party Configuration

[Kevin Ratcliffe]

I consider our migration a success. We only use a handful of SPs with no complex requirements. Office 365 is a new relying party for us and the only documentation I can find is for IdPv2. Shibboleth, for me is quite complex, I don't do Java, servlet containers and rarely touch XML so having a mashup of v2 and v3 configuration files would be a real headache. That's why I opted for a fresh slate. Could I enquire how migration 'breaks' SPs?

Kevin Ratcliffe
Network & IT Systems Support
Bolton Sixth Form College
T: 01204 846215
E: kratcliffe at bolton-sfc.ac.uk
W: www.bolton-sfc.ac.uk
Save Paper. Please consider the environment before printing.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 04 February 2016 15:32
To: Shib Users <users at shibboleth.net>
Subject: RE: IdP v3 Relying Party Configuration

> FWIW, the OP's approach (build a new IDPv3 and migrate relevant 
> settings over from IDPv2) is also what most deployers here have asked 
> about.

I know. The reason I keep harping on it is that it's not working, which isn't surprising given that it wasn't the intended method.

People are breaking SPs, and the ones they break are the ones they don't have tight connections to, namely the R&S cases where it's all ad hoc. And those are the SPs that we really care about as a community and that we got into this to help, and they're paying the price for this choice.

This same thing happened with V1 to V2, but that was not deployed at the same scale we have now, wasn't SAML 2 and had fewer options to break, and it was our fault since we gave people no way to upgrade those settings cleanly.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

This email has been scanned by BSFC and seems to be OK